Splunk Search

Locking down app and role to search only one index, why are users that are assigned this role able to search the main index?

avalle
Path Finder

Hello all,

I have looked at documentation and a few of the questions on here and have tried it all.
I have created an app (let's call it ppl app), assigned a role (let's call it ppl role) to it, and that role is locked down to one index (lets call it the ppl index).
I have given the app access to the ppl role.
I have restricted that role to search index=ppl only.

Gave it the following capabilities:
accelerate_search
change_own_password
get_typeahead
pattern_detect
search

Why are the users assigned to this role able to search the main index?
Am I missing a step somewhere?

0 Karma
1 Solution

avalle
Path Finder

I think I found the answer...........there is a delay in LDAP synch. I just had to wait it out and it worked.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

1) Check if the ppl role is inheriting any other role (say user role)?
2) There are two index related settings available while creating a role, "Indexes searched by default" and "Indexes", make sure that only your ppl index is selected in both the settings for ppl role.

0 Karma

avalle
Path Finder

I think I found the answer...........there is a delay in LDAP synch. I just had to wait it out and it worked.

0 Karma

gtriSplunk
Path Finder

Are the users members of any other role? If a user is a member of multiple roles they will be able to search indexes that are a member of any of the roles.

0 Karma

avalle
Path Finder

Yes I am sure! we had an LDAP delay.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...